Mastering API Security: From Design to Deployment
summary
Catalogs common API design bugs — unconstrained pagination (requesting 100 million items per page), predictable sequential IDs (recommend masking with hashed IDs), flexible schemas that allow mass‑assignment and data corruption, unbounded numeric/string params, and exposing server‑only fields that let users set status or id on write endpoints. Requires a formal OpenAPI spec because you can't protect what you don't know. Automates checks with Spectral for design rules and runtime tests with Schemathesis; Fensa exists as an early automated security tester.
AI-written summary · about
chapters (10)
- 0:00API security by Design
- 1:28Vulnerable API design patterns
- 4:16What is API security by Design
- 8:32Common API vulnerabilities
- 13:46Flexible schemas risks
- 15:10Unbound parameters attacks
- 16:56Exposing service-side properties
- 19:45Automating API security testing
- 22:10Design-time testing with Spectral
- 23:39Steps to secure APIs
related talks
43mAPI Security By Design
33mWhy Developers Struggle with API Security
27mAddressing OWASP API Security Top 10 starts at design time
08mAPI Security Risks
45mSecurity Architecture, An Adventure?
31mAPI security
24mAPI Security in DevSecOps: Built-In, Not Bolted On
25mAPI Security Deep Dive: Safeguard Your Digital Assets